[glm-grade=B] fix(auth): /auth/me hotfix — isValid not isSessionValid + guard (DC-093 r2)

Live verification of 4125d7a caught a 500 every 60s: the handler called
deps.session.isSessionValid(req), but the production session context
(src/context/session.js) exposes isValid — isSessionValid is only the
middleware-internal name. The round-1 test stub mirrored the wrong
name, so tests passed while prod 500'd (stub-shape-fits-bug).

- routes/auth/index.js: precompute guarded _authed (typeof isValid ===
  'function' check); malformed session object can no longer 500 a
  60s-polled endpoint. Fallback true: handler runs only after the
  session middleware admitted the request.
- routes/auth/admin.js:119: same latent 500 fixed (isSessionValid →
  isValid) — pre-existing DC-048 bug, any legacy-session /me call.
- Test stub now carries the real shape {isValid} with isSessionValid
  deliberately absent — regression to the wrong name now fails tests.

Judge: GLM-5.3 cold read round 2, grade B ship; stale-comment polish
folded in. Full suite 115/2682 green.

dashcaddy-api/__tests__/routes/auth.me.always-mounted.test.js

@@ -27,7 +27,14 @@ describe('DC-093: /auth/me always mounted (routes/auth/index.js)', () => {
       asyncHandler: (fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next),
       errorResponse: (res, code, msg) => res.status(code).json({ success: false, error: msg }),
       log: { info() {}, warn() {}, error() {}, debug() {} },
-      session: { isSessionValid: () => true },
+      // Real session context API (src/context/session.js) exposes isValid —
+      // NOT isSessionValid. The first DC-093 deploy 500'd in production
+      // because the stub mirrored the wrong method name; it now matches
+      // the real shape so the test fails if the handler drifts again.
+      session: {
+        isValid: () => true,
+        // Deliberately absent: isSessionValid — the wrong-name trap.
+      },
       licenseManager: {
         requirePremium: () => (req, res, next) => next(),
         hasFeature: () => true,